Trojaner-Board - Trojaner TR/Dlder.Loade.bbz.3

Hello an alle vorerst mal :-)

Hab seit einigen Tagen einen Trojaner namens: TR/Dlder.Loade.bbz.3

Gefunden wird er von Antivir..

Irgendwie scheint er sowas wie ein reboot system zu haben, ich lasse ihn jedesmal von antivir löschen, kommt aber nach jedem neustart wieder..

Wär nett, wenn jemand der sich auskennt mir hier hilfestellung leisten könnte, hab leidr keinerlei erfahrung mit hijackthis oder manueller entfernung von solchen "Ratten".

Vielen Dank im Voraus

Wenn antivir anschlägt schreibt Prevxhome folgende meldung:

HTML-Code:

Prevx has prevented SERVICE.EXE[880] from accessing a protected system file.
 

Process: SERVICE.EXE

Path: C:\WINNT\SYSTEM32\SERVICE.EXE

Pid: 880

Parentprocess: SERVICES.EXE

Parentpath: C:\WINNT\SYSTEM32\SERVICES.EXE

Pid: 216
 

Tried file: C:\WINNT\SYSTEM32\WIN64.EXE

AccessFlags: [0x120196] WRITE_DATA, APPEND_DATA, WRITE_EA, READ_ATTRIBUTES, WRITE_ATTRIBUTES

ParentAccess: 0x1000

CreateDisposition: [0x5] OVERWRITE_IF

Policy causing this event: unknown

The action has been denied

und das hier

HTML-Code:

Prevx has prevented SERVICE.EXE[880] from accessing a protected system file.
 

Process: SERVICE.EXE

Path: C:\WINNT\SYSTEM32\SERVICE.EXE

Pid: 880

Parentprocess: SERVICES.EXE

Parentpath: C:\WINNT\SYSTEM32\SERVICES.EXE

Pid: 216
 

Tried file: C:\WINNT\SYSTEM32\WIN16.EXE

AccessFlags: [0x120196] WRITE_DATA, APPEND_DATA, WRITE_EA, READ_ATTRIBUTES, WRITE_ATTRIBUTES

ParentAccess: 0x1000

CreateDisposition: [0x5] OVERWRITE_IF

Policy causing this event: unknown

The action has been denied

Hier mal ein Hijackthis logfile:

Code:

Logfile of HijackThis v1.98.2

Scan saved at 14:42:32, on 01.08.2006

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
 

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\SYSTEM32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Programme\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\AntiVir PersonalEdition Classic\avguard.exe

C:\Programme\Alwil Software\Avast4\ashServ.exe

C:\Programme\ewido\security suite\ewidoctrl.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINNT\system32\nvsvc32.exe

C:\Programme\Prevx Home\PXAgent.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\system32\mspmspsv.exe

C:\WINNT\System32\service.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\Explorer.EXE

C:\WINNT\system32\RUNDLL32.EXE

C:\Programme\Winamp\Winampa.exe

C:\Programme\Java\jre1.5.0_04\bin\jusched.exe

C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe

C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe

C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\Programme\QuickTime\qttask.exe

C:\Programme\DU Meter\DUMeter.exe

C:\Programme\Prevx Home\SAGUI.exe

C:\WINNT\system32\ctfmon.exe

C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe

C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE

C:\Programme\MSN Messenger\msnmsgr.exe

C:\PROGRA~1\GEMEIN~1\Nokia\MPAPI\MPAPI3s.exe

C:\Programme\Skype\Phone\Skype.exe

C:\Programme\Prevx Home\SAGUI.exe

C:\Programme\MediaMonkey\MediaMonkey.exe

C:\Programme\Mozilla Firefox\firefox.exe

G:\Programme\Thunderbird\thunderbird.exe

C:\security\hijacker\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.at/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

F2 - REG:system.ini: UserInit=C:\WINNT\system32\Userinit.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Toolbar\01.01.2607.0\msgr.de.de-at\msntb.dll (file missing)

O4 - HKLM\..\Run: [navapp] C:\Programme\NavExcel\NavHelper\v2.0.4d\navapp.exe

O4 - HKLM\..\Run: [System Information Manager] winwn.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WinampAgent] "C:\Programme\Winamp\Winampa.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [DataLayer] C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray

O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [DU Meter] C:\Programme\DU Meter\DUMeter.exe

O4 - HKLM\..\Run: [PrevxHome] C:\Programme\Prevx Home\SAGUI.exe

O4 - HKLM\..\RunServices: [System Information Manager] winwn.exe

O4 - HKLM\..\RunServices: [p2pnetwork] p2pnetwork.exe

O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe

O4 - HKCU\..\Run: [PcSync] C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\RunServices: [p2pnetwork] p2pnetwork.exe

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe

O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRA~1\Agnitum\OUTPOS~1.0\trash.exe (file missing) (HKCU)

O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRA~1\Agnitum\OUTPOS~1.0\trash.exe (file missing) (HKCU)

O12 - Plugin for .pdf: C:\Programme\Internet Explorer\PLUGINS\nppdf32.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {10000000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://www.free32.com/POP.CHM::/sp.exe

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab

O16 - DPF: {14F65762-96FB-44B9-8DAC-93845F377A0E} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/de/filesharingctrl.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab

O16 - DPF: {3EB4F9EA-51A6-48DA-846A-0D69DCBA39EF} (DownloadManager Control) - http://download.akamaitools.com.edgesuite.net/dlmanager/live/code/IE_1070/DownloadManager.cab

O16 - DPF: {40BF816B-D862-41B9-9445-ECA36D5F67F6} - http://www.1mal1.com/flatcast/NpFv49.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab

O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.kochmesser.de/scan/Msie/bitdefender.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://www.pandasoftware.com/activescan/as5/asinst.cab

O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/dd/install/guidedsolutions.cab

O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar mit Pop-Up-Blocker) - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_18_0.cab

O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin_AT.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{29F740A6-D78A-498C-9C31-07AF1DE06184}: NameServer = 195.3.96.67,195.3.96.68

O17 - HKLM\System\CCS\Services\Tcpip\..\{8F7FCCFD-69EA-49F4-80AB-27F55C02D082}: NameServer = 195.3.96.67 195.3.96.68

O17 - HKLM\System\CS1\Services\Tcpip\..\{29F740A6-D78A-498C-9C31-07AF1DE06184}: NameServer = 195.3.96.67,195.3.96.68

O17 - HKLM\System\CS2\Services\Tcpip\..\{29F740A6-D78A-498C-9C31-07AF1DE06184}: NameServer = 195.3.96.67,195.3.96.68